Case Study: Why FDA Cybersecurity Expectations Are Really QMS Expectations

Case Study: Why FDA Cybersecurity Expectations Are Really QMS Expectations

From Let's Talk Risk! with Dr. Naveen Agarwal by Casual and informal conversations about practical aspects of medical device risk management.

July 10, 2026 · 17 min

About this episode

This episode discusses the integration of cybersecurity into medical device quality management systems as per FDA guidance.

You cannot bolt cybersecurity onto a medical device at the end of development. FDA’s cybersecurity guidance makes a clear shift: cyber risk is now a quality system issue, a patient safety issue, and a lifecycle management issue. For connected and software-enabled devices, it is not enough to show that the software works as intended. Manufacturers also need to show how cybersecurity risks were identified, controlled, verified, traced to patient harm, and managed after release. In this audio summary, we walk through why FDA’s expectations go beyond submission documentation and why QA/RA teams need to understand the practical connections between SPDF, threat modeling, SBOMs, vulnerability management, postmarket patching, and the medical device QMS. Key highlights covered in the audio: * Why cybersecurity now needs to be treated as part of the medical device QMS * How Section 524(b) changes expectations for “cyber devices” * Why cyber risk needs to connect to patient harm, not just IT vulnerability * How SPDF, threat modeling, architecture views, and testing evidence fit together * Why machine-readable SBOMs and VEX documentation matter for vulnerability management * How postmarket…

More episodes of Let's Talk Risk! with Dr. Naveen Agarwal

Explore listener stats, chart rankings, contacts and more on the Let's Talk Risk! with Dr. Naveen Agarwal podcast page.